Azure Active Directory - Logout ( Mendix )

Question

We are trying Create Single Sign On application using Azure Active Directory and Mendix

The SAML Configuration is given below.

![38570-saml.jpg][1]

We are able to login with the Microsoft account but the actual problem comes when we tried to logout.

We used a microflow which calls a rest service with the endpoint “https://aad100-sandbox.mxapps.io/SSO/logout”.

It wont terminate the current user session, it just logout of the application and when we try to login it’ll automatically login into the previous session.

Please suggest any help to overcome this.

Answer 1

Hello @Giridharan M , thank you for reaching out. I see that this SAML app "Mendix" needs to be added as a non-gallery application in AAD. Ideally for any SAML application that we develop and integrate with AAD as non-gallery app, for the logout, the app should send the following logout saml request to AAD:

<samlp:LogoutResponse ID="_f0961a83-d071-4be5-a18c-9ae7b22987a4" Version="2.0" IssueInstant="2013-03-18T08:49:24.405Z" InResponseTo="iddce91f96e56747b5ace6d2e2aa9d4f8c" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://sts.windows.net/82869000-6ad1-48f0-8171-272ed18796e9/</Issuer>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</samlp:Status>
</samlp:LogoutResponse>

where the Issuer element in a LogoutRequest must exactly match one of the ServicePrincipalNames in the cloud service in Azure AD. Typically, this is set to the App ID URI that is specified during application registration.

You can collect a fiddler trace and check for the actual SAML logout request bein sent from the application to AAD. As the user hits on the sign-out button a saml_logout request gets generated by the app service and sends that saml_logout request to AAD. Azure AD then signs out the user after verifying the signature of the saml_logout request and then broadcasts logout requests to all the service-providers in that session. After that AAD sends a SAML_logout response to the App-service that initiated the signout saml request.

You can find more details on the SAML_Logout request and the way it works here: https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol

You need to make sure that the application is sending the proper saml_logout request so that Azure AD can handle it.

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as an Answer; if the above response helped in answering your query.